PT-2019-9220 · Sophos · Sophos Firewall

Published 2019-06-20 · Updated 2019-06-24 · CVE-2018-16116

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sophos XG firewall version 17.0.8 MR-8

Description The issue allows remote authenticated attackers to execute arbitrary SQL commands. This is achieved via the username GET parameter in the AccountStatus.jsp file of the Admin Portal.

Recommendations For Sophos XG firewall version 17.0.8 MR-8, consider restricting access to the AccountStatus.jsp file until a patch is available. As a temporary workaround, avoid using the username parameter in the affected API endpoint.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-16116

Affected Products

Sophos Firewall

References · 5

• https://community.sophos.com/kb/en-us/132637 · Vendor Advisory
• https://sophos.com/en-us/legal/sophos-responsible-disclosure-policy.aspx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16116 · Security Note
• https://github.com/klsecservices/Advisories/blob/master/KL-SOPHOS-2018-001.md · Note